W32.HLLW.Lacon@mm

W32.HLLW.Lacon@mm is mass-mailing worm that attempts to spread itself through email, mIRC, and file-sharing networks.

The email has the following characteristics:

Subject: National No Call Registry Info
Attachment: No Call List.exe
Message: (One of the following)

• You've probably heard about the National No Call Registry to stop telemarketers. Well I tried it just yesterday and so many people are using it I couldn't get through. But good news, they just issued this program to automate everything, check the attachment!
  
  Love ya!
  
• Finally they created a program to stop those annoying telemarketers, it adds you to the National No Call Registry automatically. Check the attachment!
  
  Keep in touch!
  
• Get added to the National No Call List to make it illegal for telemarketers to call you, just click the attachment to add yourself.
  
  Talk to you later!
  
• I just saw this on the local news. You can add yourself to this National No Call List so telemarketers stop calling. I just did it, its real easy. Just click the attachment to add yourself!
  
  See you soon!
  

This threat is written in the Microsoft Visual Basic (VB) programming language, and the VB run-time libraries must be installed for W32.HLLW.Lacon@mm to run.

Protection

• Initial Rapid Release version August 29, 2003
• Latest Rapid Release version July 19, 2008 revision 019
• Initial Daily Certified version August 29, 2003
• Latest Daily Certified version January 20, 2009 revision 048
• Initial Weekly Certified release date September 3, 2003

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: Low

Distribution

• Distribution Level: High